Shopware Plugin: Storefront Access Protection

Context

Staging, testing and pre-launch Shopware 6 environments are often publicly reachable, risking exposure of unfinished shops to visitors and search-engine crawlers. Teams needed a lightweight way to lock down an entire storefront without standing up separate authentication infrastructure.

Challenge

Access control had to cover the whole storefront and support both password protection and IP-based rules — IPv4 and IPv6, including subnet masks and IPv6 prefixes. Crucially, it had to reuse Shopware’s existing administration users rather than introduce a parallel user database, and it had to behave correctly behind reverse proxies and load balancers, where the visitor’s real IP is otherwise masked by the proxy.

Approach

I built the plugin to gate the entire storefront behind password protection plus an IP whitelist, with role-based exemptions for administrators and authorised roles. Authentication leverages the existing Shopware admin user base, so there is no separate user management to maintain. IP rules accept IPv4 and IPv6 addresses, subnet masks and IPv6 prefixes; for proxied setups, the proxy is configured as a trusted proxy via environment variables so the genuine client IP is evaluated. Setup is deliberately minimal — no extra modules — and the plugin ships in English and German, compatible with Shopware 6.5 through 6.7.

Outcome

Storefront Access Protection is published as free, open-source software on GitHub and distributed via the Shopware Store. It has been downloaded over 215 times and holds a 5.0/5 rating across five reviews, giving Shopware teams a quick, dependable way to protect test and staging environments.